Malware Disguised as a Movie File and More
It is not easy to go out for a movie night amid the brutal winter winds and fine dust. In fact, more and more people are enjoying theaters in the comfort of their homes instead of paying for expensive movie tickets and pop-corns. The rising number of people staying home to watch movies is the reason for the relatively recent rise or various streaming platforms, such as IP TV and Netflix. However, new attacks are being introduced to target these trends. Here, we will look at a case where malware was disguised as a movie file and the age verification page of a streaming service.
[Figure 1] A family watching movies at home (* shutterstock.com)
Malware Disguised as a Movie File
Recently, malware disguised as a movie file was discovered. The malware was designed to have a link format (LNK) and was distributed via a P2P file sharing program, known as torrent.
The icon of this malicious LNK file looks almost identical to a normal video file, as shown in [Figure 2]. One difference is that the malicious file has an arrow overlay icon in the left corner of the icon.
[Figure 2] Legitimate video file icon (left) / LNK malware icon (right)
This malicious file executes PowerShell and downloads an additional malware program. The PowerShell then downloads and executes various modules that perform malicious actions.
[Figure 3] Run command of the PowerShell
The file that is ultimately downloaded by the malicious LNK file is malware designed to steal cryptocurrency information.
Malware Disguised as the Age Verification Page of a Movie Streaming Website
Malware that is disguised as the age verification page of a movie streaming website was also discovered. This malware used an exploit kit that targets vulnerabilities in a user’s system.
[Figure 4] Malicious site disguised as the age verification page
The malicious page seems legitimate and almost identical to the existing age verification page of the movie streaming website. However, this page has an embedded malicious script near the bottom of the page. When a user accesses this page, this script checks the version of the application installed in their system. Then, if the version matches the version with vulnerability, the script runs a vulnerability code for that version.
Also, it changes the registry of the user’s system to install malicious programs without the user’s knowledge and allows it to change the system settings, making it more difficult for the user to detect the infection.
This malware is being distributed by the attack tool, CK VIP (KaiXin), which was used in 2014 mainly to distribute farming malware designed to steal the financial information of Korean users. CK VIP is constantly being updated to increase the attack success rate by adding new vulnerability information.
